Is portal-moonshot-2gy.netlify.app safe? TrustSniffer's low-trust assessment: 25/100

Security Alert

Kaspersky flagged this site in external intelligence checks, indicating elevated compromise/scam exposure that requires immediate caution.

This website is a subdomain on the Netlify hosting platform, with a "portal" and "moonshot" style label. At the time of analysis it served only the platform's stock "Site not found" 404 page. The page tells the visitor that a broken link was followed or a URL does not exist, and it offers a prompt to start building a site on the platform. It presents no products, pricing, services, navigation, or stated operator. No business model is observable, and the site's intended purpose cannot be determined from what it exposes.

Scam/Impersonation Risk

Contradictory signals are present and are the decisive factor in this assessment. Several independent external threat-intelligence sources currently flag the domain as malicious or suspicious, including one tier-one security vendor, which amounts to a confirmed blacklist listing. That listing is not offset by anything visible on the page, because the page contains nothing that could explain or rebut it. The sandbox also recorded concealed form elements, including password-type fields, in every observed session, although the rendered page shows no forms at all. A page that visibly offers nothing but conceals credential-capable forms is a recognised staging pattern for credential harvesting. Its heavy post-interaction page rewriting and its high volume of external requests fit the same pattern. The external destinations contacted were benign and whitelisted, so the concern is the concealed capture surface, not any observed data exfiltration. Two abuse reports exist against a shared Amazon edge address. These are attributed to shared provider infrastructure, carry no confidence weighting, and are discounted here as not specific to this site. The site's label also closely resembles the host platform's default domain naming. This is a soft lookalike signal, not a confirmed impersonation. No conflicting legal identities were observed, and no phishing page was directly confirmed. Evidence:

• Domain registration is roughly 13 days old (about 0.04 years), and the web archive holds a single snapshot dated 2026-10-07, so there is 1 year tracked with no historical continuity.
• The homepage is a 368-character default 404 page with no forms, links, or calls to action, yet the sandbox recorded hidden forms in 3 of 3 runs, with password fields present.
• External engines currently report 4 malicious and 1 suspicious detections, with one tier-one vendor among those flagging the domain.
• The homepage showed about 4,130 DOM mutations after interaction, with roughly 99.6% of requests going to external destinations.

Regulatory Verification Notes

The site publishes no legal, about, terms, privacy, or contact pages, and it names no operator or registered entity. It claims no license or registration, so there is nothing to verify and nothing that has been verified. The ownership opacity is real here, but it is an administrative gap and not an identity contradiction. The only organisation in the site's transport-encryption certificate is the hosting platform, so the certificate confirms the platform and says nothing about whoever controls this subdomain. The valid certificate is a baseline hygiene factor that does not offset the external threat detections. No third-party broker or regulatory-database record was matched, so no reputational signal from that source applies. Evidence:

• The site is served from AS16509 (AMAZON-02, United States).
• The TLS certificate is OV-validated, issued by DigiCert Global G2 TLS RSA SHA256 2020 CA1 to Netlify, Inc, and valid to 2027-03-19 (150 days remaining).
• The homepage lists no company name, licensing authority, or registration number.

What to Verify Next

Any prospective interaction should begin by establishing why the link was supplied and what the intended destination was. The host platform's default error page indicates that the content expected at this address does not exist or was never published. The intended organisation's real address should be obtained through an independent, offline route such as official correspondence, an existing contract, or a regulator's public register. Official support and contact channels should be confirmed the same way. If the site later publishes services or claims a license, that claim should be checked directly with the named registry before any reliance. External listings should be re-checked after any remediation, since a change in page content does not clear them. Evidence:

• The homepage currently exposes no operator, product, or channel that could be validated.
• The external threat listings are current at the time of analysis and have not been withdrawn.
• The concealed form behaviour was reproducible across repeated sandbox sessions, so it is not a one-off artefact.

Summary Verdict

The posture is elevated risk with high decision severity. Current external threat detections, combined with concealed credential-capable form behaviour on an otherwise empty and very recently created site, outweigh the technically sound transport security and the reputable platform behind it. The evidence supports a clearly cautionary assessment, and it does not support a legitimacy conclusion or any verified link to a real-world operator.

Infrastructure Integrity

The site is delivered through Amazon-operated edge infrastructure that sits behind the Netlify platform, and the origin server was not observable. This is a mainstream, well-regarded provider, and the infrastructure itself shows no anomalies. It is a mitigating factor only. Because only edge addresses are visible, hosting cannot be independently verified, and content can be swapped quickly behind a stable address. Protective infrastructure therefore does not offset the reputational risk.

Closing Assessment

At most, the site should be viewed in a read-only capacity. No credentials should be entered, no login attempted, and no payment or financial information submitted. Nothing should be downloaded from it. Any business with the supposed operator should be conducted only through channels confirmed independently of this site.

Signals weighed against the site

• AbuseIPDB: 2 reports on hosting IP 2a05:d014:58f:6200::259 (Amazon Data Services Ireland Ltd, Content Delivery Network), 0% confidence. The reports are attributed to shared infrastructure, not specifically to this website.